wimlib_join(): Fix buffer overrun when swm part 1 not specified

[wimlib] / src / join.c

diff --git a/src/join.c b/src/join.c
index d52bd0f242f1d4cab3d82588d3ba571e37243c05..8a0abe5d663e912c0a28d6058c820cd368eebedc 100644 (file)
--- a/src/join.c
+++ b/src/join.c
@@ -38,17 +38,17 @@
  *                  correspond to a spanned set.
  *
  * @wim:
- *     Part 1 of the set.
+ *     Part 1 of the set.
  *
  * @additional_swms:
- *     All parts of the set other than part 1.
+ *     All parts of the set other than part 1.
  *
  * @num_additional_swms:
- *     Number of WIMStructs in @additional_swms.  Or, the total number of parts
- *     in the set minus 1.
+ *     Number of WIMStructs in @additional_swms.  Or, the total number of parts
+ *     in the set minus 1.
  *
  * @return:
- *     0 on success; WIMLIB_ERR_SPLIT_INVALID if the set is not valid.
+ *     0 on success; WIMLIB_ERR_SPLIT_INVALID if the set is not valid.
  */
 static int
 verify_swm_set(WIMStruct *wim, WIMStruct **additional_swms,
@@ -56,6 +56,7 @@ verify_swm_set(WIMStruct *wim, WIMStruct **additional_swms,
 {
        unsigned total_parts = wim->hdr.total_parts;
        int ctype;
+       u32 chunk_size;
        const u8 *guid;
 
        if (total_parts != num_additional_swms + 1) {
@@ -83,9 +84,10 @@ verify_swm_set(WIMStruct *wim, WIMStruct **additional_swms,
                }
        }
 
-       /* keep track of ctype and guid just to make sure they are the same for
-        * all the WIMs. */
+       /* Keep track of the compression type, chunk size, and GUID to make sure
+        * they are the same for all the WIMs.  */
        ctype = wim->compression_type;
+       chunk_size = wim->chunk_size;
        guid = wim->hdr.guid;
 
        {
@@ -104,6 +106,12 @@ verify_swm_set(WIMStruct *wim, WIMStruct **additional_swms,
                                      "compression type");
                                return WIMLIB_ERR_SPLIT_INVALID;
                        }
+                       if (swm->chunk_size != chunk_size &&
+                           ctype != WIMLIB_COMPRESSION_TYPE_NONE) {
+                               ERROR("The split WIMs do not all have the same "
+                                     "chunk size");
+                               return WIMLIB_ERR_SPLIT_INVALID;
+                       }
                        if (memcmp(guid, swm->hdr.guid, WIM_GID_LEN) != 0) {
                                ERROR("The split WIMs do not all have the same "
                                      "GUID");
@@ -157,13 +165,12 @@ wimlib_join(const tchar * const *swm_names,
        WIMStruct **additional_swms;
        unsigned num_additional_swms;
 
-       swm_open_flags |= WIMLIB_OPEN_FLAG_SPLIT_OK;
-
        if (num_swms < 1 || num_swms > 0xffff)
                return WIMLIB_ERR_INVALID_PARAM;
        num_additional_swms = num_swms - 1;
 
-       additional_swms = CALLOC(num_additional_swms, sizeof(additional_swms[0]));
+       additional_swms = CALLOC((num_additional_swms + 1),
+                                sizeof(additional_swms[0]));
        if (!additional_swms)
                return WIMLIB_ERR_NOMEM;
 
@@ -182,6 +189,7 @@ wimlib_join(const tchar * const *swm_names,
        }
 
        if (!swm0) {
+               ERROR("Part 1 of the split WIM was not specified!");
                ret = WIMLIB_ERR_SPLIT_INVALID;
                goto out_free_swms;
        }
@@ -195,6 +203,8 @@ wimlib_join(const tchar * const *swm_names,
        if (ret)
                goto out_free_swms;
 
+       swm0->guid_set_explicitly = 1;
+
        /* It is reasonably safe to provide, WIMLIB_WRITE_FLAG_STREAMS_OK, as we
         * have verified that the specified split WIM parts form a spanned set.
         */
@@ -202,7 +212,7 @@ wimlib_join(const tchar * const *swm_names,
                           wim_write_flags | WIMLIB_WRITE_FLAG_STREAMS_OK,
                           1, progress_func);
 out_free_swms:
-       for (i = 0; i < num_additional_swms; i++)
+       for (i = 0; i < num_additional_swms + 1; i++)
                wimlib_free(additional_swms[i]);
        FREE(additional_swms);
        wimlib_free(swm0);